linux-kernel - [PATCH] libnvdimm: Fix __nd_ioctl() to check error in cmd

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed,  7 Nov 2018 11:52:41 -0700
From:   Toshi Kani <toshi.kani@....com>
To:     dan.j.williams@...el.com
Cc:     vishal.l.verma@...el.com, dave.jiang@...el.com, elliott@....com,
        linux-nvdimm@...ts.01.org, linux-kernel@...r.kernel.org,
        Toshi Kani <toshi.kani@....com>, stable@...r.kernel.org
Subject: [PATCH] libnvdimm: Fix __nd_ioctl() to check error in cmd_rc

ndctl zero-labels completes with a large number of zeroed nmems when
it fails to do zeroing on a protected NVDIMM.

  # ndctl zero-labels nmem1
  zeroed 65504 nmems

When an ACPI call completes with error, xlat_status() called from
acpi_nfit_ctl() sets error to *cmd_rc.  __nd_ioctl(), however, does
not check this error and returns with success.

Fix __nd_ioctl() to check this error in cmd_rc.

Fixes: 006358b35c73a ("libnvdimm: add support for clear poison list and badblocks for device dax")
Reported-by: Robert Elliott <elliott@....com>
Signed-off-by: Toshi Kani <toshi.kani@....com>
Cc: Dan Williams <dan.j.williams@...el.com>
Cc: Vishal Verma <vishal.l.verma@...el.com>
Cc: Dave Jiang <dave.jiang@...el.com>
Cc: <stable@...r.kernel.org>
---
 drivers/nvdimm/bus.c |    4 ++++
 1 file changed, 4 insertions(+)

diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
index f1fb39921236..af12817d8a02 100644
--- a/drivers/nvdimm/bus.c
+++ b/drivers/nvdimm/bus.c
@@ -1050,6 +1050,10 @@ static int __nd_ioctl(struct nvdimm_bus *nvdimm_bus, struct nvdimm *nvdimm,
 	rc = nd_desc->ndctl(nd_desc, nvdimm, cmd, buf, buf_len, &cmd_rc);
 	if (rc < 0)
 		goto out_unlock;
+	if (cmd_rc < 0) {
+		rc = cmd_rc;
+		goto out_unlock;
+	}
 
 	if (!nvdimm && cmd == ND_CMD_CLEAR_ERROR && cmd_rc >= 0) {
 		struct nd_cmd_clear_error *clear_err = buf;